CVE-2026-90076
UnknownSummary
In the Linux kernel, the net/sched fq module has an integer overflow when computing quantum and initial_quantum. A device with a huge MTU makes psched_mtu() return 0x80000000, and multiplication by 2 and 10 wraps to zero, causing an infinite loop in fq_dequeue() and a soft lockup.
Risk Assessment
A user with CAP_NET_ADMIN in a user namespace can trigger a kernel soft lockup. This may lead to system hang and denial of service.
Recommendation
Update the Linux kernel to a version containing the fix that clamps psched_mtu() to [1, 1 << 20] before multiplication. Consider restricting the ability to create user namespaces with CAP_NET_ADMIN.
Other vulnerabilities in Linux kernel
See all- CVE-2026-98163Unknown
A vulnerability was found in the Linux kernel's cgroup subsystem, involving iteration over dying tasks with a zero reference count. This leads to a race condition where the iterator may access a task after it has been freed, resulting in a use-after-free.
- CVE-2026-98162Unknown
In the Linux kernel, the smb2_tree_connect() function of the SMB server (ksmbd) leaks a tree connection. When ksmbd_iov_pin_rsp() fails, the newly created tree connection is not disconnected, leading to a resource leak.
- CVE-2026-98161Unknown
In the Linux kernel, the nvdimm (pmem) pmem_submit_bio() function records a REQ_PREFLUSH error but continues to copy bio data and can later overwrite the error with a successful REQ_FUA flush. This allows data writes to run after a failed preflush and can complete the bio successfully despite the failed ordering barrier.
- CVE-2026-98160Unknown
In the Linux kernel, the staging rtl8723bs driver's rtw_sdio_if1_init() function frees padapter->HalData with kfree(), even though it was allocated via vzalloc(). Using kfree() to release a vmalloc-backed buffer can lead to memory corruption.
- CVE-2026-100079Unknown
In the Linux kernel, the USB Type-C (ucsi) subsystem's ucsi_register() creates per-instance debugfs entries, but ucsi_unregister() keeps them until ucsi_destroy(). Drivers like ucsi_glink that unregister/register the same UCSI instance across remoteproc restart then try to create an already existing debugfs directory.
- CVE-2026-100078Unknown
In the Linux kernel, the iwlwifi (mei) driver's iwl_mei_write_cyclic_buf() function receives an incorrect first argument — the q_head pointer is passed instead of cldev. The bug has been fixed.
- CVE-2026-100077Unknown
In the Linux kernel, the drm/msm driver does not safely retire a hung submit before GPU recovery completes. Retiring the submit triggers BO free, which can result in GPU pagefaults since the GPU may be actively accessing those BOs.
- CVE-2026-100074Unknown
In the Linux kernel, a bug was fixed where the BPF_REFCOUNT field was not marked as unique, although it should be. The fix addresses this oversight.
- CVE-2026-100073Unknown
In the Linux kernel, a bug in the ext4 filesystem related to transaction overflow during writeback was fixed. A previous fix was too eager in reducing reserved transaction credits, leading to insufficient reservation in some corner cases. The fix uses ext4_meta_trans_blocks() for a correct upper bound estimate.
- CVE-2026-100072Unknown
In the Linux kernel, a problem in the ACPI subsystem was fixed where the use of acpi_get_first_physical_node() in acpi_platform_fill_resource() and acpi_create_platform_device() was unsafe because the returned device could be freed at any time. The fix replaces it with acpi_bus_get_primary_device() and adjusts the code to call it only once.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: add overflow bounds to quantum and initial quantum fq_init() computes quantum = 2 * psched_mtu() and initial_quantum = 10 * psched_mtu() with no overflow check. A device with a huge MTU (e.g. dummy with max_mtu == 0 accepting MTU 2147483634) makes psched_mtu() return 0x80000000; the 2 * and 10 * multiplications wrap to 0 in 32-bit arithmetic, so q->quantum == 0. Then in fq_dequeue() the credit-refill loop adds 0 to f->credit (which stays <= 0) and goto begin loops forever under the qdisc lock, creating a soft lockup. Clamp psched_mtu() to [1, 1 << 20] before multiplying so the product cannot wrap, then cap the result at 1 << 20, matching the bound already enforced on TCA_FQ_QUANTUM in fq_change(). Conditions to recreate the bug: a device whose MTU (plus hard_header_len) is large enough that 2 * psched_mtu() wraps (e.g. a dummy device with max_mtu == 0 accepting MTU 2147483634). Requires CAP_NET_ADMIN in a user namespace.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS